diff --git a/extensions/cookie/test/test_app_uninstall_permissions.html b/extensions/cookie/test/test_app_uninstall_permissions.html
index afb1f1d46c4..13cf9f7380b 100644
--- a/extensions/cookie/test/test_app_uninstall_permissions.html
+++ b/extensions/cookie/test/test_app_uninstall_permissions.html
@@ -42,7 +42,7 @@ function getPermissionCountForApp(aAppId) {
   while (enumerator.hasMoreElements()) {
     var permission = enumerator.getNext().QueryInterface(Ci.nsIPermission);
 
-    if (permission.appId == aAppId || aAppId == -1) {
+    if (permission.principal.appId == aAppId || aAppId == -1) {
       nbPermissions++;
     }
   }
diff --git a/extensions/cookie/test/unit/test_permmanager_defaults.js b/extensions/cookie/test/unit/test_permmanager_defaults.js
index 7798542edec..47e18c4fcc5 100644
--- a/extensions/cookie/test/unit/test_permmanager_defaults.js
+++ b/extensions/cookie/test/unit/test_permmanager_defaults.js
@@ -2,8 +2,8 @@
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 // The origin we use in most of the tests.
-const TEST_ORIGIN = "example.org";
-const TEST_ORIGIN_2 = "example.com";
+const TEST_ORIGIN = NetUtil.newURI("http://example.org");
+const TEST_ORIGIN_2 = NetUtil.newURI("http://example.com");
 const TEST_PERMISSION = "test-permission";
 Components.utils.import("resource://gre/modules/Promise.jsm");
 
@@ -35,8 +35,8 @@ add_task(function* do_test() {
 
   conv.writeString("# this is a comment\n");
   conv.writeString("\n"); // a blank line!
-  conv.writeString("host\t" + TEST_PERMISSION + "\t1\t" + TEST_ORIGIN + "\n");
-  conv.writeString("host\t" + TEST_PERMISSION + "\t1\t" + TEST_ORIGIN_2 + "\n");
+  conv.writeString("host\t" + TEST_PERMISSION + "\t1\t" + TEST_ORIGIN.spec + "\n");
+  conv.writeString("host\t" + TEST_PERMISSION + "\t1\t" + TEST_ORIGIN_2.spec + "\n");
   ostream.close();
 
   // Set the preference used by the permission manager so the file is read.
@@ -47,8 +47,7 @@ add_task(function* do_test() {
            getService(Ci.nsIPermissionManager);
 
   // test the default permission was applied.
-  let permURI = NetUtil.newURI("http://" + TEST_ORIGIN);
-  let principal = Services.scriptSecurityManager.getNoAppCodebasePrincipal(permURI);
+  let principal = Services.scriptSecurityManager.getNoAppCodebasePrincipal(TEST_ORIGIN);
 
   do_check_eq(Ci.nsIPermissionManager.ALLOW_ACTION,
               pm.testPermissionFromPrincipal(principal, TEST_PERMISSION));
@@ -105,8 +104,7 @@ add_task(function* do_test() {
   // check default permissions and removeAllSince work as expected.
   pm.removeAll(); // ensure only defaults are there.
 
-  let permURI2 = NetUtil.newURI("http://" + TEST_ORIGIN_2);
-  let principal2 = Services.scriptSecurityManager.getNoAppCodebasePrincipal(permURI2);
+  let principal2 = Services.scriptSecurityManager.getNoAppCodebasePrincipal(TEST_ORIGIN_2);
 
   // default for both principals is allow.
   do_check_eq(Ci.nsIPermissionManager.ALLOW_ACTION,
@@ -149,12 +147,12 @@ add_task(function* do_test() {
 // use an enumerator to find the requested permission.  Returns the permission
 // value (ie, the "capability" in nsIPermission parlance) or null if it can't
 // be found.
-function findCapabilityViaEnum(host = TEST_ORIGIN, type = TEST_PERMISSION) {
+function findCapabilityViaEnum(origin = TEST_ORIGIN, type = TEST_PERMISSION) {
   let result = undefined;
   let e = Services.perms.enumerator;
   while (e.hasMoreElements()) {
     let perm = e.getNext().QueryInterface(Ci.nsIPermission);
-    if (perm.host == host &&
+    if (perm.matchesURI(origin, true) &&
         perm.type == type) {
       if (result !== undefined) {
         // we've already found one previously - that's bad!
@@ -171,12 +169,12 @@ function findCapabilityViaEnum(host = TEST_ORIGIN, type = TEST_PERMISSION) {
 // distinct possibility exists that our checking of the DB will happen before
 // the permission manager update has completed - so we just retry a few times.
 // Returns a promise.
-function checkCapabilityViaDB(expected, host = TEST_ORIGIN, type = TEST_PERMISSION) {
+function checkCapabilityViaDB(expected, origin = TEST_ORIGIN, type = TEST_PERMISSION) {
   let deferred = Promise.defer();
   let count = 0;
   let max = 20;
   let do_check = () => {
-    let got = findCapabilityViaDB(host, type);
+    let got = findCapabilityViaDB(origin.host, type);
     if (got == expected) {
       // the do_check_eq() below will succeed - which is what we want.
       do_check_eq(got, expected, "The database has the expected value");
diff --git a/extensions/cookie/test/unit/test_permmanager_getPermissionObject.js b/extensions/cookie/test/unit/test_permmanager_getPermissionObject.js
index 9ab4ff21f0f..f2f13f38e3a 100644
--- a/extensions/cookie/test/unit/test_permmanager_getPermissionObject.js
+++ b/extensions/cookie/test/unit/test_permmanager_getPermissionObject.js
@@ -29,20 +29,20 @@ function run_test() {
   pm.addFromPrincipal(principal, "test/pobject", pm.ALLOW_ACTION);
   var rootPerm = pm.getPermissionObject(principal, "test/pobject", false);
   do_check_true(rootPerm != null);
-  do_check_eq(rootPerm.host, "example.com");
+  do_check_eq(rootPerm.principal.origin, "http://example.com");
   do_check_eq(rootPerm.type, "test/pobject");
   do_check_eq(rootPerm.capability, pm.ALLOW_ACTION);
   do_check_eq(rootPerm.expireType, pm.EXPIRE_NEVER);
 
   var rootPerm2 = pm.getPermissionObject(principal, "test/pobject", true);
   do_check_true(rootPerm != null);
-  do_check_eq(rootPerm.host, "example.com");
+  do_check_eq(rootPerm.principal.origin, "http://example.com");
 
   var subPerm = pm.getPermissionObject(subPrincipal, "test/pobject", true);
   do_check_null(subPerm);
   subPerm = pm.getPermissionObject(subPrincipal, "test/pobject", false);
   do_check_true(subPerm != null);
-  do_check_eq(subPerm.host, "example.com");
+  do_check_eq(subPerm.principal.origin, "http://example.com");
   do_check_eq(subPerm.type, "test/pobject");
   do_check_eq(subPerm.capability, pm.ALLOW_ACTION);
 
@@ -50,7 +50,7 @@ function run_test() {
   do_check_null(subPerm);
   subPerm = pm.getPermissionObject(subSubPrincipal, "test/pobject", false);
   do_check_true(subPerm != null);
-  do_check_eq(subPerm.host, "example.com");
+  do_check_eq(subPerm.principal.origin, "http://example.com");
 
   pm.addFromPrincipal(principal, "test/pobject", pm.DENY_ACTION, pm.EXPIRE_SESSION);
 
@@ -63,28 +63,28 @@ function run_test() {
   do_check_eq(rootPerm.expireType, pm.EXPIRE_SESSION);
 
   subPerm = pm.getPermissionObject(subPrincipal, "test/pobject", false);
-  do_check_eq(subPerm.host, "example.com");
+  do_check_eq(subPerm.principal.origin, "http://example.com");
   do_check_eq(subPerm.capability, pm.DENY_ACTION);
   do_check_eq(subPerm.expireType, pm.EXPIRE_SESSION);
 
   pm.addFromPrincipal(subPrincipal, "test/pobject", pm.PROMPT_ACTION);
   rootPerm = pm.getPermissionObject(principal, "test/pobject", true);
-  do_check_eq(rootPerm.host, "example.com");
+  do_check_eq(rootPerm.principal.origin, "http://example.com");
   do_check_eq(rootPerm.capability, pm.DENY_ACTION);
 
   subPerm = pm.getPermissionObject(subPrincipal, "test/pobject", true);
-  do_check_eq(subPerm.host, "sub.example.com");
+  do_check_eq(subPerm.principal.origin, "http://sub.example.com");
   do_check_eq(subPerm.capability, pm.PROMPT_ACTION);
 
   subPerm = pm.getPermissionObject(subPrincipal, "test/pobject", false);
-  do_check_eq(subPerm.host, "sub.example.com");
+  do_check_eq(subPerm.principal.origin, "http://sub.example.com");
   do_check_eq(subPerm.capability, pm.PROMPT_ACTION);
 
   subPerm = pm.getPermissionObject(subSubPrincipal, "test/pobject", true);
   do_check_null(subPerm);
 
   subPerm = pm.getPermissionObject(subSubPrincipal, "test/pobject", false);
-  do_check_eq(subPerm.host, "sub.example.com");
+  do_check_eq(subPerm.principal.origin, "http://sub.example.com");
   do_check_eq(subPerm.capability, pm.PROMPT_ACTION);
 
   pm.removeFromPrincipal(principal, "test/pobject");
diff --git a/extensions/cookie/test/unit/test_permmanager_mailto.js b/extensions/cookie/test/unit/test_permmanager_mailto.js
index 21b1f6c60a2..1c111295bec 100644
--- a/extensions/cookie/test/unit/test_permmanager_mailto.js
+++ b/extensions/cookie/test/unit/test_permmanager_mailto.js
@@ -10,28 +10,29 @@ function run_test() {
   // make a mailto: URI with parameters
   let uri = Services.io.newURI("mailto:" + kTestAddr + "?subject=test", null,
                                null);
+  let origin = "mailto:" + kTestAddr;
 
   // add a permission entry for that URI
   Services.perms.add(uri, kType, kCapability);
-  do_check_true(permission_exists(kTestAddr, kType, kCapability));
+  do_check_true(permission_exists(origin, kType, kCapability));
 
   // remove the permission, and make sure it was removed
   Services.perms.remove(uri, kType);
-  do_check_false(permission_exists(kTestAddr, kType, kCapability));
+  do_check_false(permission_exists(origin, kType, kCapability));
 
   uri = Services.io.newURI("mailto:" + kTestAddr, null, null);
   Services.perms.add(uri, kType, kCapability);
-  do_check_true(permission_exists(kTestAddr, kType, kCapability));
+  do_check_true(permission_exists(origin, kType, kCapability));
 
   Services.perms.remove(uri, kType);
-  do_check_false(permission_exists(kTestAddr, kType, kCapability));
+  do_check_false(permission_exists(origin, kType, kCapability));
 }
 
-function permission_exists(aHost, aType, aCapability) {
+function permission_exists(aOrigin, aType, aCapability) {
   let e = Services.perms.enumerator;
   while (e.hasMoreElements()) {
     let perm = e.getNext().QueryInterface(Ci.nsIPermission);
-    if (perm.host == aHost &&
+    if (perm.principal.origin == aOrigin &&
         perm.type == aType &&
         perm.capability == aCapability) {
       return true;
diff --git a/netwerk/test/unit/test_permmgr.js b/netwerk/test/unit/test_permmgr.js
index f472770a5f7..5a6ddd8b5a1 100644
--- a/netwerk/test/unit/test_permmgr.js
+++ b/netwerk/test/unit/test_permmgr.js
@@ -2,31 +2,31 @@
 
 var hosts = [
   // format: [host, type, permission]
-  ["mozilla.org", "cookie", 1],
-  ["mozilla.org", "image", 2],
-  ["mozilla.org", "popup", 3],
-  ["mozilla.com", "cookie", 1],
-  ["www.mozilla.com", "cookie", 2],
-  ["dev.mozilla.com", "cookie", 3]
+  ["http://mozilla.org", "cookie", 1],
+  ["http://mozilla.org", "image", 2],
+  ["http://mozilla.org", "popup", 3],
+  ["http://mozilla.com", "cookie", 1],
+  ["http://www.mozilla.com", "cookie", 2],
+  ["http://dev.mozilla.com", "cookie", 3]
 ];
 
 var results = [
   // format: [host, type, testPermission result, testExactPermission result]
   // test defaults
-  ["localhost", "cookie", 0, 0],
-  ["spreadfirefox.com", "cookie", 0, 0],
+  ["http://localhost", "cookie", 0, 0],
+  ["http://spreadfirefox.com", "cookie", 0, 0],
   // test different types
-  ["mozilla.org", "cookie", 1, 1],
-  ["mozilla.org", "image", 2, 2],
-  ["mozilla.org", "popup", 3, 3],
+  ["http://mozilla.org", "cookie", 1, 1],
+  ["http://mozilla.org", "image", 2, 2],
+  ["http://mozilla.org", "popup", 3, 3],
   // test subdomains
-  ["www.mozilla.org", "cookie", 1, 0],
-  ["www.dev.mozilla.org", "cookie", 1, 0],
+  ["http://www.mozilla.org", "cookie", 1, 0],
+  ["http://www.dev.mozilla.org", "cookie", 1, 0],
   // test different permissions on subdomains
-  ["mozilla.com", "cookie", 1, 1],
-  ["www.mozilla.com", "cookie", 2, 2],
-  ["dev.mozilla.com", "cookie", 3, 3],
-  ["www.dev.mozilla.com", "cookie", 3, 0]
+  ["http://mozilla.com", "cookie", 1, 1],
+  ["http://www.mozilla.com", "cookie", 2, 2],
+  ["http://dev.mozilla.com", "cookie", 3, 3],
+  ["http://www.dev.mozilla.com", "cookie", 3, 0]
 ];
 
 function run_test() {
@@ -45,16 +45,16 @@ function run_test() {
 
   // put a few hosts in
   for (var i = 0; i < hosts.length; ++i) {
-    var uri = ioService.newURI("http://" + hosts[i][0], null, null);
-    var principal = secMan.getNoAppCodebasePrincipal(uri);
+    let uri = ioService.newURI(hosts[i][0], null, null);
+    let principal = secMan.getNoAppCodebasePrincipal(uri);
 
     pm.addFromPrincipal(principal, hosts[i][1], hosts[i][2]);
   }
 
   // test the result
   for (var i = 0; i < results.length; ++i) {
-    var uri = ioService.newURI("http://" + results[i][0], null, null);
-    var principal = secMan.getNoAppCodebasePrincipal(uri);
+    let uri = ioService.newURI(results[i][0], null, null);
+    let principal = secMan.getNoAppCodebasePrincipal(uri);
 
     do_check_eq(pm.testPermissionFromPrincipal(principal, results[i][1]), results[i][2]);
     do_check_eq(pm.testExactPermissionFromPrincipal(principal, results[i][1]), results[i][3]);
@@ -72,16 +72,13 @@ function run_test() {
 
   // ... remove all the hosts ...
   for (var j = 0; j < perms.length; ++j) {
-    var uri = ioService.newURI("http://" + perms[j].host, null, null);
-    var principal = secMan.getNoAppCodebasePrincipal(uri);
-
-    pm.removeFromPrincipal(principal, perms[j].type);
+    pm.removePermission(perms[j]);
   }
   
   // ... ensure each and every element is equal ...
   for (var i = 0; i < hosts.length; ++i) {
     for (var j = 0; j < perms.length; ++j) {
-      if (hosts[i][0] == perms[j].host &&
+      if (perms[j].matchesURI(ioService.newURI(hosts[i][0], null, null), true) &&
           hosts[i][1] == perms[j].type &&
           hosts[i][2] == perms[j].capability) {
         perms.splice(j, 1);
@@ -102,7 +99,7 @@ function run_test() {
   var enumerator = pm.enumerator;
   do_check_eq(enumerator.hasMoreElements(), true);
   var ace = enumerator.getNext().QueryInterface(Components.interfaces.nsIPermission);
-  do_check_eq(ace.host, aceref);
+  do_check_eq(ace.principal.URI.asciiHost, aceref);
   do_check_eq(enumerator.hasMoreElements(), false);
 
   // test removeAll()